According to a statement announcing both the charges and settlement agreement, the FTC found that "Google used deceptive tactics and violated its own privacy promises to consumers" when Buzz launched, and that such deceptive practices violated both the FTC Act and the U.S.-EU Safe Harbor framework.

Under the terms of the settlement, Google must undergo an independent audit of its privacy practices every other year for 20 years. The company must also adopt a "comprehensive privacy program" and must not misrepresent the privacy of user information or compliance with the Safe Harbor framework. If Google plans to use information differently than in the manner disclosed when it first collected the information, users must consent to the change in plans.

The charges mark the first time the FTC has charged noncompliance with the Safe Harbor agreement, as well as the first time it has imposed a long-standing independent privacy audit requirement. (The UK imposed a similar audit requirement following its investigation into Google's "inadvertent" collection of private Wi-Fi data while ramping up its Street View program there.)